Subject: RE: [mobile-ip] fastv6 and CoAs

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Fri, 20 Sep 2002 18:40:28 +0200

> Not exactly since the Previous router can supply the exact
> (previous) IP address of the MN. Of course a malicious node
> could spoof that address itself, but that probability is smaller.
> Furthermore, if we keep the tunnel lifetime short enough, the
> incentive for launching an improbable "attack" is decreased even
> more.
>

Having a malicious node spoof a previous CoA is no different than having
a
malicious node spoof a CoA on the current subnet.

=> The difference is you can't locate the attacker
(identify the subnet). This is the intention of 
RFC2267.

The router needs to do ingress filtering by address rather than by
prefix. 

=> That can only be done on p2p links.

But
it is doing that anyway in effect for packets coming in through the
tunnel.

=> I'm concerned about packets originating from the
MN (on the ingress interface of the router). 

Hesham

---

From: "James Kempf" <[email-masked]>
Date: Fri, 20 Sep 2002 11:24:16 -0700

> MN (on the ingress interface of the router).

So here's how I see this working:

1) Old AR and new AR have a security association.

2) Old AR and new AR exchange HI/HaCK with old CoA and L2 id of MN about to
undergo handover. New AR agrees to handle the tunnel.

3) New AR inserts a source route, and simultaneously modifies its ingress filter
so that packets from old CoA originating on the air interface side will get
routed into the tunnel interface.

4) MN shows up on new link, starts sending all packets with old CoA to new AR.

5) New AR checks against source routes, old CoA matches, link layer address
matches, routes down the tunnel.

Let's consider some attacks:

1) Attacker on the air interface side starts sending packets with the old CoA
and the link layer address (both need to be spoofed in order to pass the ingress
filter). The router will route down the tunnel.

2) Attacker on the air interface side starts sending packets with a vaild CoA on
the subnet and a valid link layer address of another node on the subnet. The
router routes the packet out.

So I guess I don't see much difference. Or did you have a different threat in
mind?

>(identify the subnet). This is the intention of

As Section 1 of RFC 2267 says:

   While the filtering method discussed in this document does
   absolutely nothing to protect against flooding attacks which
   originate from valid prefixes (IP addresses), it will prohibit an
   attacker within the originating network from launching an attack of
   this nature using forged source addresses that do not conform to
   ingress filtering rules.

The source route makes the old CoA a valid (/128) prefix on the subnet, because
it is established by a secure transaction between the routers.

            jak

---

From: "s. goswami" <[email-masked]>
Date: Fri, 20 Sep 2002 14:55:34 -0400 (EDT)

Another point is,  are you assuming that a L2 connected device MUST
not be trusted ? Are not all wireless L2 connections authenticated
is some way ? 802.11 does.

See my comments below.

> filter). The router will route down the tunnel.

You also are assuming the attacker has access to the L2 security
credentials of the legitimate MN somehow. Highly unlikely.

> router routes the packet out.

Same as 1.